Almost everything I run is a Docker container, so I made /var/lib/docker a btrfs subvolume, and then I make every day incremental snapshots (cron job) and copy them to a secondary disk (also btrfs, using btrbk). Since they are btrfs snapshots they don't use a lot of disk space and if I really need to rollback an entire day I can